CVE-2026-64247

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: hyper-v: Bound the bank index when querying sparse banks

When checking if a VP ID is included in a sparse bank set, explicitly check

that the ID can actually be contained in a sparse bank (the TLFS allows for

a maximum of 64 banks of 64 vCPUs each). When handling a paravirtual TLB

flush for L2, the VP ID is copied verbatim from the enlightened VMCS,

without any bounds check, i.e. isn't guaranteed to be under the limit of

4096.

Failure to check the bounds of the VP ID leads to an out-of-bounds read

when testing the sparse bank, and super strictly speaking could lead to KVM

performing an unnecessary TLB flush for an L2 vCPU.

==================================================================

BUG: KASAN: use-after-free in hv_is_vp_in_sparse_set+0x85/0x100 [kvm]

Read of size 8 at addr ffff88811ba5f598 by task hyperv_evmcs/2802

CPU: 12 UID: 1000 PID: 2802 Comm: hyperv_evmcs Not tainted 7.1.0-rc2 #7 PR

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References